diff --git a/.github/workflows/build_kernel.yaml b/.github/workflows/build_kernel.yaml
index 18e4e7d7..a7973a10 100644
--- a/.github/workflows/build_kernel.yaml
+++ b/.github/workflows/build_kernel.yaml
@@ -5,11 +5,19 @@ on:
   pull_request:
     branches: [main]
     types: [opened, synchronize, reopened] # trigger on PRs
-    paths-ignore:
-      - "docs/**"
-      - "*.md"
+    paths:
+      - "nix-builder/**"
+      - "kernel-builder/**"
+      - "examples/kernels/**"
+      - "**/*.nix"
+      - "**/flake.lock"
+      - ".github/workflows/build_kernel.yaml"
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   build:
     name: Build kernels (${{ matrix.arch }})
diff --git a/.github/workflows/build_kernel_macos.yaml b/.github/workflows/build_kernel_macos.yaml
index 905a05bd..8561a56c 100644
--- a/.github/workflows/build_kernel_macos.yaml
+++ b/.github/workflows/build_kernel_macos.yaml
@@ -5,11 +5,19 @@ on:
   pull_request:
     branches: [main]
     types: [opened, synchronize, reopened] # trigger on PRs
-    paths-ignore:
-      - "docs/**"
-      - "*.md"
+    paths:
+      - "nix-builder/**"
+      - "kernel-builder/**"
+      - "examples/kernels/**"
+      - "**/*.nix"
+      - "**/flake.lock"
+      - ".github/workflows/build_kernel_macos.yaml"
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   build:
     name: Build kernel
diff --git a/.github/workflows/build_kernel_rocm.yaml b/.github/workflows/build_kernel_rocm.yaml
index 6d090477..7397f014 100644
--- a/.github/workflows/build_kernel_rocm.yaml
+++ b/.github/workflows/build_kernel_rocm.yaml
@@ -5,11 +5,19 @@ on:
   pull_request:
     branches: [main]
     types: [opened, synchronize, reopened] # trigger on PRs
-    paths-ignore:
-      - "docs/**"
-      - "*.md"
+    paths:
+      - "nix-builder/**"
+      - "kernel-builder/**"
+      - "examples/kernels/**"
+      - "**/*.nix"
+      - "**/flake.lock"
+      - ".github/workflows/build_kernel_rocm.yaml"
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   build:
     name: Build kernel
diff --git a/.github/workflows/build_kernel_windows.yaml b/.github/workflows/build_kernel_windows.yaml
index 64a265db..ffc8e1a1 100644
--- a/.github/workflows/build_kernel_windows.yaml
+++ b/.github/workflows/build_kernel_windows.yaml
@@ -5,11 +5,19 @@ on:
   pull_request:
     branches: [main]
     types: [opened, synchronize, reopened] # trigger on PRs
-    paths-ignore:
-      - "docs/**"
-      - "*.md"
+    paths:
+      - "nix-builder/**"
+      - "kernel-builder/**"
+      - "examples/kernels/**"
+      - "**/*.nix"
+      - "**/flake.lock"
+      - ".github/workflows/build_kernel_windows.yaml"
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   build:
     strategy:
diff --git a/.github/workflows/build_kernel_xpu.yaml b/.github/workflows/build_kernel_xpu.yaml
index b9246f86..7fa1abc2 100644
--- a/.github/workflows/build_kernel_xpu.yaml
+++ b/.github/workflows/build_kernel_xpu.yaml
@@ -5,11 +5,19 @@ on:
   pull_request:
     branches: [main]
     types: [opened, synchronize, reopened] # trigger on PRs
-    paths-ignore:
-      - "docs/**"
-      - "*.md"
+    paths:
+      - "nix-builder/**"
+      - "kernel-builder/**"
+      - "examples/kernels/**"
+      - "**/*.nix"
+      - "**/flake.lock"
+      - ".github/workflows/build_kernel_xpu.yaml"
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   build:
     name: Build kernel
diff --git a/.github/workflows/check_variants.yaml b/.github/workflows/check_variants.yaml
index 45ce5d6b..2cf74b6b 100644
--- a/.github/workflows/check_variants.yaml
+++ b/.github/workflows/check_variants.yaml
@@ -5,11 +5,18 @@ on:
   pull_request:
     branches: [main]
     types: [opened, synchronize, reopened] # trigger on PRs
-    paths-ignore:
-      - "docs/**"
-      - "*.md"
+    paths:
+      - "nix-builder/**"
+      - "**/*.nix"
+      - "**/flake.lock"
+      - "docs/source/builder/build-variants.md"
+      - ".github/workflows/check_variants.yaml"
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   build:
     name: Check build variants
diff --git a/.github/workflows/kernel-builder-cli-docs.yaml b/.github/workflows/kernel-builder-cli-docs.yaml
index 606da7e6..f9832141 100644
--- a/.github/workflows/kernel-builder-cli-docs.yaml
+++ b/.github/workflows/kernel-builder-cli-docs.yaml
@@ -12,6 +12,10 @@ on:
     branches:
       - main
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   check-cli-docs:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/kernel_abi_python_release.yaml b/.github/workflows/kernel_abi_python_release.yaml
index c7d9aee9..f5435773 100644
--- a/.github/workflows/kernel_abi_python_release.yaml
+++ b/.github/workflows/kernel_abi_python_release.yaml
@@ -13,11 +13,20 @@ on:
     tags:
       - "*"
   pull_request:
-    paths-ignore:
-      - "docs/**"
-      - "*.md"
+    paths:
+      - "kernel-abi-check/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - ".github/workflows/kernel_abi_python_release.yaml"
   workflow_dispatch:
 
+concurrency:
+  # Hardcoded prefix because this workflow shares `name: CI` with
+  # kernels_data_python_release.yaml; ${{ github.workflow }} would
+  # otherwise collide and cancel the sibling workflow's run.
+  group: kernel-abi-python-release-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
 
diff --git a/.github/workflows/kernels_data_python_release.yaml b/.github/workflows/kernels_data_python_release.yaml
index 491efb25..5d924798 100644
--- a/.github/workflows/kernels_data_python_release.yaml
+++ b/.github/workflows/kernels_data_python_release.yaml
@@ -7,7 +7,9 @@
 #  - manifest paths made relative
 #  - publish step switched from `uv publish` + API token to
 #    `PyO3/maturin-action` + PyPI trusted publishing (see plan.md §3a, §3b)
-#  - pull_request trigger gained `paths-ignore` for docs-only PRs
+#  - pull_request trigger scoped to kernels-data/** and Cargo.{toml,lock}
+#    so unrelated PRs don't trigger the full wheel matrix
+#  - added concurrency cancellation for in-progress PR builds
 name: CI
 
 on:
@@ -18,11 +20,20 @@ on:
     tags:
       - "*"
   pull_request:
-    paths-ignore:
-      - "docs/**"
-      - "*.md"
+    paths:
+      - "kernels-data/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - ".github/workflows/kernels_data_python_release.yaml"
   workflow_dispatch:
 
+concurrency:
+  # Hardcoded prefix because this workflow shares `name: CI` with
+  # kernel_abi_python_release.yaml; ${{ github.workflow }} would
+  # otherwise collide and cancel the sibling workflow's run.
+  group: kernels-data-python-release-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
 
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 2b351d8b..4997c83f 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -1,10 +1,16 @@
 name: Lints
 on:
   push:
+    branches: [main]
   pull_request:
-    paths-ignore:
-      - "docs/**"
-      - "*.md"
+    paths:
+      - "kernels/**"
+      - "kernels-data/src/python_dependencies.json"
+      - ".github/workflows/lint.yml"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 env:
   RUFF_VERSION: "0.15.10"
diff --git a/.github/workflows/nix_checks.yml b/.github/workflows/nix_checks.yml
index 22e31ee0..e97f7637 100644
--- a/.github/workflows/nix_checks.yml
+++ b/.github/workflows/nix_checks.yml
@@ -5,11 +5,19 @@ on:
   pull_request:
     branches: [main]
     types: [opened, synchronize, reopened] # trigger on PRs
-    paths-ignore:
-      - "docs/**"
-      - "*.md"
+    paths:
+      - "nix-builder/**"
+      - "kernel-builder/**"
+      - "examples/kernels/**"
+      - "**/*.nix"
+      - "**/flake.lock"
+      - ".github/workflows/nix_checks.yml"
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   build:
     name: Nix checks
diff --git a/.github/workflows/publish_kernels.yml b/.github/workflows/publish_kernels.yml
index 6ecf2460..07d44e36 100644
--- a/.github/workflows/publish_kernels.yml
+++ b/.github/workflows/publish_kernels.yml
@@ -1,6 +1,10 @@
 name: Publish Python 🐍 distribution 📦 to PyPI and TestPyPI
 
-on: push
+on:
+  push:
+    branches: [main]
+    tags:
+      - "*"
 
 jobs:
   build:
diff --git a/.github/workflows/rust.yaml b/.github/workflows/rust.yaml
index abf7ec46..71b8d8bc 100644
--- a/.github/workflows/rust.yaml
+++ b/.github/workflows/rust.yaml
@@ -2,10 +2,19 @@ name: Rust
 
 on:
   push:
+    branches: [main]
   pull_request:
-    paths-ignore:
-      - "docs/**"
-      - "*.md"
+    paths:
+      - "kernel-abi-check/**"
+      - "kernels-data/**"
+      - "kernel-builder/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - ".github/workflows/rust.yaml"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   fmt:
@@ -41,6 +50,8 @@ jobs:
             ~/.cargo/git/db/
             target/
           key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-
       - uses: dtolnay/rust-toolchain@e081816240890017053eacbb1bdf337761dc5582 # 1.95.0
         with:
           components: clippy
@@ -69,6 +80,8 @@ jobs:
             ~/.cargo/git/db/
             target/
           key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-
       - uses: dtolnay/rust-toolchain@e081816240890017053eacbb1bdf337761dc5582 # 1.95.0
       - name: Test (kernel-abi-check)
         run: cargo test -p kernel-abi-check
diff --git a/.github/workflows/test_extra_commands.yaml b/.github/workflows/test_extra_commands.yaml
index 84b54af4..02eec7c3 100644
--- a/.github/workflows/test_extra_commands.yaml
+++ b/.github/workflows/test_extra_commands.yaml
@@ -5,11 +5,19 @@ on:
   pull_request:
     branches: [main]
     types: [opened, synchronize, reopened] # trigger on PRs
-    paths-ignore:
-      - "docs/**"
-      - "*.md"
+    paths:
+      - "nix-builder/**"
+      - "kernel-builder/**"
+      - "examples/kernels/**"
+      - "**/*.nix"
+      - "**/flake.lock"
+      - ".github/workflows/test_extra_commands.yaml"
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   build:
     name: Build kernel
diff --git a/.github/workflows/test_kernels.yaml b/.github/workflows/test_kernels.yaml
index 44dfaada..76e5fa93 100644
--- a/.github/workflows/test_kernels.yaml
+++ b/.github/workflows/test_kernels.yaml
@@ -6,9 +6,11 @@ on:
   pull_request:
     branches: [main]
     types: [opened, synchronize, reopened] # trigger on PRs
-    paths-ignore:
-      - "docs/**"
-      - "*.md"
+    paths:
+      - "kernels/**"
+      - "kernels-data/bindings/python/**"
+      - "kernel-abi-check/bindings/python/**"
+      - ".github/workflows/test_kernels.yaml"
   workflow_dispatch:
 
 concurrency:
diff --git a/.github/workflows/test_python.yaml b/.github/workflows/test_python.yaml
index de57b465..f3f1265b 100644
--- a/.github/workflows/test_python.yaml
+++ b/.github/workflows/test_python.yaml
@@ -6,9 +6,10 @@ on:
   pull_request:
     branches: [main]
     types: [opened, synchronize, reopened] # trigger on PRs
-    paths-ignore:
-      - "docs/**"
-      - "*.md"
+    paths:
+      - "kernel-abi-check/**"
+      - "kernels-data/**"
+      - ".github/workflows/test_python.yaml"
   workflow_dispatch:
 
 concurrency: